---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: fleet
    chart: fleet
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
  name: fleet
  namespace: {{ .Release.Namespace }}
spec:
  replicas: {{ .Values.replicas }}
  selector:
    matchLabels:
      app: fleet
      chart: fleet
      heritage: {{ .Release.Service }}
      release: {{ .Release.Name }}
  template:
    metadata:
{{- with .Values.podAnnotations }}
      annotations:
{{- toYaml . | trim | nindent 8 }}
{{- end }}
      labels:
        app: fleet
        chart: fleet
        heritage: {{ .Release.Service }}
        release: {{ .Release.Name }}
    spec:
      containers:
      - name: fleet
        command:
        {{- if .Values.fleet.autoApplySQLMigrations }}
        - /bin/sh
        - -c
        - /usr/bin/fleet prepare db --no-prompt && /usr/bin/fleet serve
        {{ else }}
        - /usr/bin/fleet
        - serve
        {{- end }}
        image: fleetdm/fleet:{{ .Values.imageTag }}
        ports:
        - name: fleet
          containerPort: {{ .Values.fleet.listenPort }}
        resources:
          limits:
            cpu: {{ .Values.resources.limits.cpu }}
            memory: {{ .Values.resources.limits.memory }}
          requests:
            cpu: {{ .Values.resources.requests.cpu }}
            memory: {{ .Values.resources.requests.memory }}
        env:
          ## BEGIN FLEET SECTION
          - name: FLEET_SERVER_ADDRESS
            value: "0.0.0.0:{{ .Values.fleet.listenPort }}"
          - name: FLEET_AUTH_BCRYPT_COST
            value: "{{ .Values.fleet.auth.bcryptCost }}"
          - name: FLEET_AUTH_SALT_KEY_SIZE
            value: "{{ .Values.fleet.auth.saltKeySize }}"
          - name: FLEET_APP_TOKEN_KEY_SIZE
            value: "{{ .Values.fleet.app.tokenKeySize }}"
          - name: FLEET_APP_TOKEN_VALIDITY_PERIOD
            value: "{{ .Values.fleet.app.inviteTokenValidityPeriod }}"
          - name: FLEET_SESSION_KEY_SIZE
            value: "{{ .Values.fleet.session.keySize }}"
          - name: FLEET_SESSION_DURATION
            value: "{{ .Values.fleet.session.duration }}"
          - name: FLEET_LOGGING_DEBUG
            value: "{{ .Values.fleet.logging.debug }}"
          - name: FLEET_LOGGING_JSON
            value: "{{ .Values.fleet.logging.json }}"
          - name: FLEET_LOGGING_DISABLE_BANNER
            value: "{{ .Values.fleet.logging.disableBanner }}"
          - name: FLEET_SERVER_TLS
            value: "{{ .Values.fleet.tls.enabled }}"
          {{- if .Values.fleet.tls.enabled }}
          - name: FLEET_SERVER_TLS_COMPATIBILITY
            value: "{{ .Values.fleet.tls.compatibility }}"
          - name: FLEET_SERVER_CERT
            value: "/secrets/tls/{{ .Values.fleet.tls.certSecretKey }}"
          - name: FLEET_SERVER_KEY
            value: "/secrets/tls/{{ .Values.fleet.tls.keySecretKey }}"
          {{- end }}
          {{- if ne .Values.fleet.carving.s3.bucketName "" }}
          - name: FLEET_S3_BUCKET
            value: "{{ .Values.fleet.carving.s3.bucketName }}"
          - name: FLEET_S3_PREFIX
            value: "{{ .Values.fleet.carving.s3.prefix }}"
          {{- if ne .Values.fleet.carving.s3.accessKeyID "" }}
          - name: FLEET_S3_ACCESS_KEY_ID
            value: "{{ .Values.fleet.carving.s3.accessKeyID }}"
          - name: FLEET_S3_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.fleet.secretName }}"
                key: "{{ .Values.fleet.carving.s3.secretKey }}"
          {{ else }}
          - name: FLEET_S3_STS_ASSUME_ROLE_ARN
            value: "{{ .Values.fleet.carving.s3.stsAssumeRoleARN }}"
          {{- end }}
          {{- end }}
          ## END FLEET SECTION
          ## BEGIN MYSQL SECTION
          - name: FLEET_MYSQL_ADDRESS
            value: "{{ .Values.mysql.address }}"
          - name: FLEET_MYSQL_DATABASE
            value: "{{ .Values.mysql.database }}"
          - name: FLEET_MYSQL_USERNAME
            value: "{{ .Values.mysql.username }}"
          - name: FLEET_MYSQL_PASSWORD
            valueFrom:
              secretKeyRef:
                name: {{ .Values.mysql.secretName }}
                key: {{ .Values.mysql.passwordKey }}
          - name: FLEET_MYSQL_MAX_OPEN_CONNS
            value: "{{ .Values.mysql.maxOpenConns }}"
          - name: FLEET_MYSQL_MAX_IDLE_CONNS
            value: "{{ .Values.mysql.maxIdleConns }}"
          - name: FLEET_MYSQL_CONN_MAX_LIFETIME
            value: "{{ .Values.mysql.connMaxLifetime }}"
          {{- if .Values.mysql.tls.enabled }}
          - name: FLEET_MYSQL_TLS_CA
            value: "/secrets/mysql/{{ .Values.mysql.tls.caCertKey }}"
          - name: FLEET_MYSQL_TLS_CERT
            value: "/secrets/mysql/{{ .Values.mysql.tls.certKey }}"
          - name: FLEET_MYSQL_TLS_KEY
            value: "/secrets/mysql/{{ .Values.mysql.tls.keyKey }}"
          - name: FLEET_MYSQL_TLS_CONFIG
            value: "{{ .Values.mysql.tls.config }}"
          - name: FLEET_MYSQL_TLS_SERVER_NAME
            value: "{{ .Values.mysql.tls.serverName }}"
          {{- end }}
          ## END MYSQL SECTION
          ## BEGIN REDIS SECTION
          - name: FLEET_REDIS_ADDRESS
            value: "{{ .Values.redis.address }}"
          - name: FLEET_REDIS_DATABASE
            value: "{{ .Values.redis.database }}"
          {{- if .Values.redis.usePassword }}
          - name: FLEET_REDIS_PASSWORD
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.redis.secretName }}"
                key: "{{ .Values.redis.passwordKey }}"
          {{- end }}
          ## END REDIS SECTION
          ## BEGIN OSQUERY SECTION
          - name: FLEET_OSQUERY_NODE_KEY_SIZE
            value: "{{ .Values.osquery.nodeKeySize }}"
          - name: FLEET_OSQUERY_LABEL_UPDATE_INTERVAL
            value: "{{ .Values.osquery.labelUpdateInterval }}"
          - name: FLEET_OSQUERY_DETAIL_UPDATE_INTERVAL
            value: "{{ .Values.osquery.detailUpdateInterval }}"
          - name: FLEET_OSQUERY_STATUS_LOG_PLUGIN
            value: "{{ .Values.osquery.logging.statusPlugin }}"
          - name: FLEET_OSQUERY_RESULT_LOG_PLUGIN
            value: "{{ .Values.osquery.logging.resultPlugin }}"
          {{- if eq .Values.osquery.logging.statusPlugin "filesystem" }}
          - name: FLEET_FILESYSTEM_STATUS_LOG_FILE
            value: "/logs/{{ .Values.osquery.logging.filesystem.statusLogFile }}"
          {{- end }}
          {{- if eq .Values.osquery.logging.resultPlugin "filesystem" }}
          - name: FLEET_FILESYSTEM_RESULT_LOG_FILE
            value: "/logs/{{ .Values.osquery.logging.filesystem.resultLogFile }}"
          {{- end }}
          {{- if or (eq .Values.osquery.logging.statusPlugin "filesystem") (eq .Values.osquery.logging.resultPlugin "filesystem") }}
          - name: FLEET_FILESYSTEM_ENABLE_LOG_ROTATION
            value: "{{ .Values.osquery.logging.filesystem.enableRotation }}"
          - name: FLEET_FILESYSTEM_ENABLE_LOG_COMPRESSION
            value: "{{ .Values.osquery.logging.filesystem.enableCompression }}"
          {{- end }}

          {{- if or (eq .Values.osquery.logging.statusPlugin "firehose") (eq .Values.osquery.logging.resultPlugin "firehose") }}
          - name: FLEET_FIREHOSE_REGION
            value: "{{ .Values.osquery.logging.firehose.region }}"
          {{- if eq .Values.osquery.logging.statusPlugin "firehose" }}
          - name: FLEET_FIREHOSE_STATUS_STREAM
            value: "{{ .Values.osquery.logging.firehose.statusStream }}"
          {{- end }}
          {{- if eq .Values.osquery.logging.resultPlugin "firehose" }}
          - name: FLEET_FIREHOSE_RESULT_STREAM
            value: "{{ .Values.osquery.logging.firehose.resultStream }}"
          {{- end }}
          {{- if ne .Values.osquery.logging.firehose.accessKeyID "" }}
          - name: FLEET_FIREHOSE_ACCESS_KEY_ID
            value: "{{ .Values.osquery.logging.firehose.accessKeyID }}"
          - name: FLEET_FIREHOSE_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.osquery.secretName }}"
                key: "{{ .Values.osquery.logging.firehose.secretKey }}"
          {{ else }}
          - name: FLEET_FIREHOSE_STS_ASSUME_ROLE_ARN
            value: "{{ .Values.osquery.logging.firehose.stsAssumeRoleARN }}"
          {{- end }}
          {{- end }}

          {{- if or (eq .Values.osquery.logging.statusPlugin "kinesis") (eq .Values.osquery.logging.resultPlugin "kinesis") }}
          - name: FLEET_KINESIS_REGION
            value: "{{ .Values.osquery.logging.kinesis.region }}"
          {{- if eq .Values.osquery.logging.statusPlugin "kinesis" }}
          - name: FLEET_KINESIS_STATUS_STREAM
            value: "{{ .Values.osquery.logging.kinesis.statusStream }}"
          {{- end }}
          {{- if eq .Values.osquery.logging.resultPlugin "kinesis" }}
          - name: FLEET_KINESIS_RESULT_STREAM
            value: "{{ .Values.osquery.logging.kinesis.resultStream }}"
          {{- end }}
          {{- if ne .Values.osquery.logging.kinesis.accessKeyID "" }}
          - name: FLEET_KINESIS_ACCESS_KEY_ID
            value: "{{ .Values.osquery.logging.kinesis.accessKeyID }}"
          - name: FLEET_KINESIS_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.osquery.secretName }}"
                key: "{{ .Values.osquery.logging.kinesis.secretKey }}"
          {{ else }}
          - name: FLEET_KINESIS_STS_ASSUME_ROLE_ARN
            value: "{{ .Values.osquery.logging.kinesis.stsAssumeRoleARN }}"
          {{- end }}
          {{- end }}

          {{- if or (eq .Values.osquery.logging.statusPlugin "lambda") (eq .Values.osquery.logging.resultPlugin "lambda") }}
          - name: FLEET_LAMBDA_REGION
            value: "{{ .Values.osquery.logging.lambda.region }}"
          {{- if eq .Values.osquery.logging.statusPlugin "lambda" }}
          - name: FLEET_LAMBDA_STATUS_FUNCTION
            value: "{{ .Values.osquery.logging.lambda.statusFunction }}"
          {{- end }}
          {{- if eq .Values.osquery.logging.resultPlugin "lambda" }}
          - name: FLEET_LAMBDA_RESULT_FUNCTION
            value: "{{ .Values.osquery.logging.lambda.resultFunction }}"
          {{- end }}
          {{- if ne .Values.osquery.logging.lambda.accessKeyID "" }}
          - name: FLEET_LAMBDA_ACCESS_KEY_ID
            value: "{{ .Values.osquery.logging.lambda.accessKeyID }}"
          - name: FLEET_LAMBDA_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.osquery.secretName }}"
                key: "{{ .Values.osquery.logging.lambda.secretKey }}"
          {{ else }}
          - name: FLEET_LAMBDA_STS_ASSUME_ROLE_ARN
            value: "{{ .Values.osquery.logging.lambda.stsAssumeRoleARN }}"
          {{- end }}
          {{- end }}


          {{- if or (eq .Values.osquery.logging.statusPlugin "pubsub") (eq .Values.osquery.logging.resultPlugin "pubsub") }}
          - name: FLEET_PUBSUB_PROJECT
            value: "{{ .Values.osquery.logging.pubsub.project }}"
          {{- end }}
          {{- if eq .Values.osquery.logging.statusPlugin "pubsub" }}
          - name: FLEET_PUBSUB_STATUS_TOPIC
            value: "{{ .Values.osquery.logging.pubsub.statusTopic }}"
          {{- end }}
          {{- if eq .Values.osquery.logging.resultPlugin "pubsub" }}
          - name: FLEET_PUBSUB_RESULT_TOPIC
            value: "{{ .Values.osquery.logging.pubsub.resultTopic }}"
          {{- end }}
          ## END OSQUERY SECTION
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: [ALL]
          privileged: false
          readOnlyRootFilesystem: true
          runAsGroup: 3333
          runAsUser: 3333
          runAsNonRoot: true
        livenessProbe:
          httpGet:
            path: /healthz
            port: {{ .Values.fleet.listenPort }}
        readinessProbe:
          httpGet:
            path: /healthz
            port: {{ .Values.fleet.listenPort }}
        {{- if or (.Values.fleet.tls.enabled) (.Values.mysql.tls.enabled) (eq .Values.osquery.logging.statusPlugin "filesystem") (eq .Values.osquery.logging.resultPlugin "filesystem") }}
        volumeMounts:
          {{- if .Values.fleet.tls.enabled }}
          - name: fleet-tls
            readOnly: true
            mountPath: /secrets/tls
          {{- end }}
          {{- if .Values.mysql.tls.enabled }}
          - name: mysql-tls
            readOnly: true
            mountPath: /secrets/mysql
          {{- end }}
          {{- if or (eq .Values.osquery.logging.statusPlugin "filesystem") (eq .Values.osquery.logging.resultPlugin "filesystem") }}
          - name: osquery-logs
            mountPath: /logs
          {{- end }}
        {{- end }}
      {{- if .Values.gke.cloudSQL.enableProxy }}
      - name: cloudsql-proxy
        image: "gcr.io/cloudsql-docker/gce-proxy:{{ .Values.gke.cloudSQL.imageTag }}"
        command:
        - "/cloud_sql_proxy"
        - "-verbose={{ .Values.gke.cloudSQL.verbose}}"
        - "-instances={{ .Values.gke.cloudSQL.instanceName }}=tcp:3306"
        resources:
          limits:
            cpu: 0.5 # 500Mhz
            memory: 150Mi
          requests:
            cpu: 0.1 # 100Mhz
            memory: 50Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: [ALL]
          privileged: false
          readOnlyRootFilesystem: true
          runAsGroup: 3333
          runAsUser: 3333
          runAsNonRoot: true
      {{- end }}
      hostPID: false
      hostNetwork: false
      hostIPC: false
      serviceAccountName: fleet
      {{- if or (.Values.fleet.tls.enabled) (.Values.mysql.tls.enabled) (eq .Values.osquery.logging.statusPlugin "filesystem") (eq .Values.osquery.logging.resultPlugin "filesystem") }}
      volumes:
        {{- if .Values.fleet.tls.enabled }}
        - name: fleet-tls
          secret:
            secretName: "{{ .Values.fleet.secretName }}"
        {{- end }}
        {{- if .Values.mysql.tls.enabled }}
        - name: mysql-tls
          secret:
            secretName: "{{ .Values.mysql.secretName }}"
        {{- end }}
        {{- if or (eq .Values.osquery.logging.statusPlugin "filesystem") (eq .Values.osquery.logging.resultPlugin "filesystem") }}
        - name: osquery-logs
          emptyDir:
            sizeLimit: "{{ .Values.osquery.logging.filesystem.volumeSize }}"
        {{- end }}
      {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
    {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
    {{- end }}
